# REPORT — controller v0.241.0: a bind-data app leans on off-site before its own unit (2026-09-13, evening)

*Overwritten each run. This records the most recent implementation only.*

> **Operator ruling R-479, shipped as v0.241.0 and delivered by the managed floor** (declared MinAgent
> 0.129.0): demo-hp +16 s, demo-felhom +18 s. Proven live on demo-hp with a nextcloud throwaway on the
> registered drive. Evidence: `felhom.eu/documentation/audits/v0241-2026-09-13/`.

## What changed (`3e81330`)

- `UpdateTierOrderFor` / `DataOutsideUnit`: an app with classified binds walks 2 → 3 → 1; a volume app
  keeps 2 → 1 → 3. `UpdateRestorePoints` reads it.
- `RestoreHold.CopyHolds` + `UpdateCopyHolds`: the hold sentence ends with what the chosen copy holds;
  the adapter passes it through `HoldAfterFailedUpdateHolding`. Holds from v0.239.0–v0.240.0 keep the
  tier-only sentence (`UpdateHoldTierFmt`).

## Gates, tests, red-proof, live

- `go build ./... && go vet ./... && go test ./...` green; `controller_gates.py --fast` green.
- `internal/backup/r479_tier_order_test.go`: order per layout, the consequence (Tier 2 absent, unit
  and off-site both fresh → the bind app leans on off-site), the phrases, the sentence verbatim, the
  older sentence; the adapter wiring test demands the phrase.
- Red-proof: a layout-blind order fails the bind case (`rp-v241-R479-order-layout-blind.txt`).
- Live (`13-R479-live.txt`): nextcloud with `HDD_PATH` on the drive (2 classified binds), Tier 2 off,
  backup now (unit with db-dump and volume tars), a never-healthy update → held, the sentence names
  „saját meghajtó, 2026-09-13 21:51 — ez a másolat csak a beállításokat és az adatbázist tartalmazza,
  a fájlokat nem." The 2→3→1 preference is unit-proven only: a live off-site run would touch the
  standing apps' leg.

## Observations

1. **A removed app keeps its `update_failed` hold in the store; a reinstall under the same name would start held.** FILED: R-491
2. **The 2→3→1 preference was not exercised live (no off-site run on a box with standing apps).** NOT-A-FINDING: the unit test and red-proof pin it; a live pass belongs to a night whose throwaway has off-site of its own.